backlog-md
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent ingests and processes task data from an external tracking system, creating a potential vector for indirect prompt injection.
- Ingestion points: The agent is instructed to read task content (descriptions, acceptance criteria, notes) in references/task-workflow.md using the command
backlog task 42 --plain. - Boundary markers: There are no instructions or patterns provided to the agent to treat task content as untrusted or to use delimiters to prevent embedded instructions from overriding the agent's primary goals.
- Capability inventory: The agent has access to the
backlogCLI tool to perform writes, edits, and searches, and potentially other tools permitted by the platform's configuration. - Sanitization: The instructions lack guidance on sanitizing or validating the input from the task management system before the agent proceeds with implementation steps.
Audit Metadata